All Endpoint Security Policies
The question it answers: Which endpoint security policies exist, what kind are they, and which are not assigned to anything?
Every policy in Intune’s Endpoint security area in one list: antivirus, disk encryption, firewall, EDR, attack surface reduction, account protection, App Control, Endpoint Privilege Management and security baselines. Unassigned policies and policies without settings are flagged. What the ASR and firewall settings actually enforce is checked in Endpoint Security Posture.
At a glance
Section titled “At a glance”| Where in the app | Intune › Endpoint Security › All Endpoint Security Policies |
| Workload | Intune |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Intune. EDR, ASR and App Control policies need Defender for Endpoint / Windows E3+ to take full effect; Endpoint Privilege Management needs the Intune Suite or its add-on. |
| Report id (API and MCP) | intune.endpoint-security.policies |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Category | Category | Text |
| Policy | Subject | Link |
| Platform | Setting | Text |
| Template | Value | Text |
| Status | Finding | Text |
| Assignment | Detail | Text |
| Last modified | When | Date |
| Settings | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Intune. EDR, ASR and App Control policies need Defender for Endpoint / Windows E3+ to take full effect; Endpoint Privilege Management needs the Intune Suite or its add-on.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementConfiguration.Read.All | Microsoft Graph | Read Microsoft Intune device configuration and policies |
Data sources it reads
GET /beta/deviceManagement/configurationPolicies?$expand=assignmentsGET /beta/deviceManagement/intentsGET /beta/deviceManagement/templates
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.endpoint-security.policies?size=100An AI assistant reads it with the MCP tool get_report and the id intune.endpoint-security.policies. The client needs the Read grant for Intune. See Using the API.